Before: zegit's Gitea jobs run in host mode on this runner image, which has no ssh-keygen. zegit's SSHSIG oracle test (TestSSHSIG_ChecksumsVerifyWithSSHKeygen_441, #501) fails under CI without it, so Gitea lint + test stayed red on zegit master 639871e0 and the v0.1.56 cut is refused (zegit#575). GitHub's ARC pool was fixed separately, by zegit-arc-runner#21 and zegit#578.
After: the image carries openssh-keygen, and a build step signs and verifies an SSHSIG in namespace file, the form the zegit test uses.
How: one apk package and a build-time smoke step. Checked on the operator workstation: the image builds, and zegit's test passes inside it with CI=1.
Merging publishes the next 12.11.1-ci<N> tag. flux-config then re-pins the three runner deployments (zegit-runner, forgejo-runner) to it by digest, which is a cluster change with a Falco review after it rolls.
<!-- claude-projects-attribution: {"github_login":"AtomicBackspace"} -->
_Requested by **Markus** · [project thread](https://claude.ai/code/project/chan_01VZVzJf1ggm8Ck9zzkXBenz?thread=cmsg_01VZVzJf1ggm8Ck9zzkXBenzPcV9mXjpvw2o2BHSJQ3XeX)_
Before: zegit's Gitea jobs run in host mode on this runner image, which has no `ssh-keygen`. zegit's SSHSIG oracle test (`TestSSHSIG_ChecksumsVerifyWithSSHKeygen_441`, #501) fails under CI without it, so Gitea `lint + test` stayed red on zegit master 639871e0 and **the v0.1.56 cut is refused** (zegit#575). GitHub's ARC pool was fixed separately, by zegit-arc-runner#21 and zegit#578.
After: the image carries `openssh-keygen`, and a build step signs and verifies an SSHSIG in namespace `file`, the form the zegit test uses.
How: one apk package and a build-time smoke step. Checked on the operator workstation: the image builds, and zegit's test passes inside it with `CI=1`.
**Merging publishes the next `12.11.1-ci<N>` tag.** flux-config then re-pins the three runner deployments (zegit-runner, forgejo-runner) to it by digest, which is a cluster change with a Falco review after it rolls.
Refs zegit-zoo/zegit#575
🤖 Generated with [Claude Code](https://claude.com/claude-code)
zegit's TestSSHSIG_ChecksumsVerifyWithSSHKeygen_441 verifies release
checksum signatures with `ssh-keygen -Y verify` and fails under CI when
ssh-keygen is missing. zegit's Gitea jobs run in host mode on this
runner image, which has no ssh-keygen, so Gitea `lint + test` stayed red
on zegit master 639871e0 and the v0.1.56 cut is refused (zegit#575).
GitHub's ARC pool was fixed separately (zegit-arc-runner#21, zegit#578).
openssh-keygen joins the apk list, and a build step signs and verifies
an SSHSIG in namespace "file", so a build without a working ssh-keygen
fails here.
Checked on the operator workstation: the image builds, and zegit's test
passes inside it with CI=1 (`ok cmd/z-backend`, ssh-keygen at
/usr/bin/ssh-keygen).
Refs: zegit-zoo/zegit#575
Co-Authored-By: Claude Opus 5.5 <[email protected]>
markus
marked the pull request as ready for review 2026-11-12 15:53:44 +00:00
markus
merged commit 94dcdbcfeb into master2026-11-12 15:53:48 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Requested by Markus · project thread
Before: zegit's Gitea jobs run in host mode on this runner image, which has no
ssh-keygen. zegit's SSHSIG oracle test (TestSSHSIG_ChecksumsVerifyWithSSHKeygen_441, #501) fails under CI without it, so Gitealint + teststayed red on zegit master 639871e0 and the v0.1.56 cut is refused (zegit#575). GitHub's ARC pool was fixed separately, by zegit-arc-runner#21 and zegit#578.After: the image carries
openssh-keygen, and a build step signs and verifies an SSHSIG in namespacefile, the form the zegit test uses.How: one apk package and a build-time smoke step. Checked on the operator workstation: the image builds, and zegit's test passes inside it with
CI=1.Merging publishes the next
12.11.1-ci<N>tag. flux-config then re-pins the three runner deployments (zegit-runner, forgejo-runner) to it by digest, which is a cluster change with a Falco review after it rolls.Refs zegit-zoo/zegit#575
🤖 Generated with Claude Code